Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware.

The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine.

For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems.

The attack begins with malicious search advertisements that steer victims toward convincing public artifact pages. After a user downloads and runs the supposed installer, the infection moves quickly through several stages.

The final payload is SectopRAT, a remote-access tool that can steal information and give attackers hidden control of an infected device. Such access can let criminals collect files, watch activity, or return later with further instructions.

CyberProof said in a report shared with Cyber Security News (CSN). Its analysts noted that the activity matches the FakeAgent campaign previously tracked in the wild, where attackers abuse public hosting and spoofed installers to deliver malware.

The incident was identified from an alert involving a scheduled task designed to look like a normal software update. Analysts then correlated evidence across the affected endpoint instead of treating that signal as a standalone event.

The case underlines a wider problem for businesses and home users alike. A familiar name is often enough to lower a victim’s guard, particularly when an advertisement appears above legitimate search results.

Recent reporting on fake Gemini installer attacks shows that criminals are also exploiting other popular AI brands to push credential-stealing malware.

Hackers Use Fake Claude Desktop App

Once the victim launched the counterfeit application, it used PowerShell to add exclusions for folders in the user profile, reducing Microsoft Defender visibility over the area where malicious files were staged.

The initial loader then used DLL sideloading, a method that makes a legitimate program load a harmful supporting file. This allowed the code to run in the context of a signed Java Chromium Embedded Framework helper.

The mismatch between the displayed application name and the program’s internal details was a valuable warning sign.

The malware also created a logon-triggered task with elevated privileges while disguising it as a browser updater. That task called a second loader from a user-writable roaming folder, allowing the infection to return after a reboot.

Abuse of native scheduling features remains a proven way to retain access, as shown in reports on Windows scheduled task abuse.

CyberProof’s investigation found that the operators avoided a conventional command server. Instead, the malware relied on EtherHiding, retrieving encrypted connection details from Ethereum blockchain data.

That approach can make takedowns harder because the attacker can rotate infrastructure without relying on one fixed domain or server.

Containment Needs Full Response

Researchers stressed that removing a visible task or one malicious file is not enough when remote-access malware has executed.

In the observed incident, responders isolated the device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to check whether stolen credentials had been used elsewhere.

Defenders should investigate newly created high-privilege tasks that launch software from Downloads, AppData, or other user-controlled locations.

The agent’s attack chain reconstruction (Source - CyberProof) — The agent’s attack chain reconstruction (Source – CyberProof)

They should also flag new antivirus exclusions made soon after a download and inspect unexpected library loads outside normal program folders. Similar chains that combine spoofed software and library loading have appeared in AsyncRAT fake installer campaigns.

Organizations can reduce exposure by directing staff to approved software channels and restricting local installation rights where practical. Search advertisements for developer and AI tools deserve extra caution, even when the landing page looks legitimate.

Monitoring browser-originated downloads, scheduler changes, security-setting changes, and blockchain RPC traffic together can help teams recognize the full attack rather than treating each alert as an isolated event.

That broader view is important when attackers intentionally spread their activity across several ordinary Windows features.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	`ClaudeDesktop.exe`	Initial trojanized loader
File metadata	`JCEF Helper / jcef_helper.exe`	Internal metadata associated with the fake loader
File name	`DockerDesktop.exe`	Staged loader used for reboot persistence
File name	`libcef.dll`	VMProtect-packed DLL used in the sideloading chain
File name	`tempdir.dll`	DLL name included in the hunting logic for suspicious sideloading activity
File name	`Claude.exe`	Suspicious installer-related file name included in hunting logic
File name	`ClaudeSetup.exe`	Suspicious installer-related file name included in hunting logic
File name	`Docker Desktop.exe`	Suspicious installer-related file name included in hunting logic
File path	`AppData\Roaming\EdgeUpdate-1b4adb1f\`	User-writable staging directory
Scheduled task	`MicrosoftEdgeUpdate`	Disguised logon persistence task configured with elevated privileges
Domain	`downloading-api.it.com`	Malvertising download infrastructure
Domain	`neeitoerw[.]my`	Suspicious domain observed in the process lineage
IP address	`153.75.84.173`	Network infrastructure observed in the process lineage
URL pattern	`claude[.]ai/public/artifacts/[id]`	Masqueraded lure artifact page
URL / domain	`download-app.us`	Suspicious origin included in hunting logic
URL / domain	`claude-desktop.gitlab.io`	Suspicious origin included in hunting logic
URL / domain	`claude.ai.download-app.us`	Suspicious origin included in hunting logic
URL path	`it.com/html/claude/win`	Suspicious origin included in hunting logic
Domain	`claude-code-cmd.squarespace.com`	Suspicious origin included in hunting logic
URL path	`code.claude.ai/download`	Suspicious origin included in hunting logic
Domain	`install-files.com`	Suspicious origin included in hunting logic
Keyword	`claude-code`	Suspicious origin keyword included in hunting logic
Keyword	`claude-desktop`	Suspicious origin keyword included in hunting logic
SHA-256	`f8acb8f5...`	Partial hash of the initial payload, as published in the source report

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware appeared first on Cyber Security News.